i18next-fs-backend vulnerabilities

2 known vulnerabilities in i18next-fs-backend from I18next. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  i18next-fs-backend: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-48713Jun 15, 2026I18next

  Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input). Backend.writeFile() splits each queue

• 8.2 High severity

  i18next-fs-backend: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-41693May 8, 2026I18next

  i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2.6.4, i18next-fs-backend substitutes the lng and ns options directly into the configured loadPath / addPath templates an